@event4u/agent-config 10.3.0 → 11.0.0

package/dist/ui/index.html

@@ -27,7 +27,7 @@
                 document.documentElement.setAttribute('data-theme', theme);
             })();
         </script>
-      <script type="module" crossorigin src="/assets/index-5fXOHoVh.js"></script>
+      <script type="module" crossorigin src="/assets/index-B0aMJnuz.js"></script>
       <link rel="stylesheet" crossorigin href="/assets/index-jSfMW8_t.css">
     </head>
     <body>

package/docs/contracts/settings-classes.md

@@ -39,9 +39,10 @@ surface without a consumer.
 **It governs writes, not reads.** Every class is readable by everything. A C
 class does not hide a value; it refuses to let a non-human change it.
 
-**It governs writes, not asks.** Four settings ship an `ask` value in their own
-enum (`tokens.rich_skills`, `subagents.adversarial_council`, `worktrees.mode`,
-`decision_engine.on_block`).
+**It governs writes, not asks.** Three settings ship an `ask` value in their own
+enum (`tokens.rich_skills`, `subagents.adversarial_council`,
+`decision_engine.on_block`). It was four until ADR-229 deleted
+`worktrees.mode`.
 Those are C-class here, and that is not a contradiction: the class says who may
 *persist* a new value; the `ask` value says what happens *at runtime* when the
 setting is already set to `ask`. A C-class key set to `ask` still produces a
@@ -189,12 +190,15 @@ dispatch runs, not WHETHER the layer exists, so they keep their own C rows.
 |---|---|
 | A — preference | 26 |
 | B — consent | 3 |
-| C — guarded | 106 |
-| **Total** | **135** |
+| C — guarded | 105 |
+| **Total** | **134** |
 
 The total was 140 until 2026-08-12, when five of the six keys no code path read were
 deleted, minus the one held open (§ The six unread keys, below): one A
-(`telegraph.speak_scope`) and four C.
+(`telegraph.speak_scope`) and four C. It dropped to 134 on 2026-08-13 when
+ADR-229 deleted `worktrees.mode` — a fifth C, and the first deletion in this
+series of a key that WAS read: the doctrine there is that the decision was never
+the agent's to make, not that nothing consulted it.
 
 The total is every leaf in the template, where *leaf* means anything that is not
 a **non-empty** map. An empty map (like the former `subagents.host_capabilities: {}`) is a real
@@ -244,9 +248,9 @@ the template, which is the drift this contract exists to prevent.
 |---|---|
 | derivable | 83 |
 | un-inferrable | 9 |
-| consent | 38 |
+| consent | 37 |
 | policy | 5 |
-| **Total** | **135** |
+| **Total** | **134** |
 
 First measured 2026-08-12 at 140 leaves (derivable 88 · consent 38 ·
 un-inferrable 9 · policy 5), from the table below rather than predicted — the
@@ -421,7 +425,6 @@ Rows follow template order, so a diff against the template reads straight down.
 | `subagents.model_ceiling` | C | `""` | session-wide subagent model cap (exported as `CLAUDE_CODE_SUBAGENT_MODEL` by suite-owned CLI spawn wrappers), which is spend and quality | consent |
 | `subagents.max_parallel` | C | `3` | parallelism cap, and therefore a spend rate | consent |
 | `subagents.adversarial_council` | C | `"off"` | governs a paid verification step | consent |
-| `worktrees.mode` | C | `ask` | standing permission for autonomous worktree creation | consent |
 | `ai_team.model` | C | `auto` | names an external model | un-inferrable |
 | `ai_team.allow_delegate` | C | `false` | grants an external tool write access to the repository | consent |
 | `ai_team.max_calls_per_day` | C | `50` | quota cap on a shared budget | consent |

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@event4u/agent-config",
     "mcpName": "io.github.event4u-app/agent-config",
-    "version": "10.3.0",
+    "version": "11.0.0",
     "description": "Governed skills, rules and commands for AI coding tools (Claude Code, Cursor, Windsurf, Copilot) — every claim machine-checked, including \"zero runtime daemon\".",
     "license": "MIT",
     "private": false,

package/src/agent-src/templates/scripts/work_engine/directives/ui/design.ts

@@ -345,7 +345,10 @@ function _halt_provided_without_contract(
         '> 1. Proceed — port it with those five losses on the record; `apply` ' +
             'still has to report what it honoured, translated, and flagged',
         '> 2. Supply a `design-system.json` — its token values are then ' +
-            'honoured verbatim instead of re-derived',
+            'honoured verbatim instead of re-derived. Already have an ' +
+            "extractor's output in another shape? `/design-system:import " +
+            '<file>` maps a DTCG token file or an extraction tool\'s raw JSON ' +
+            'into this contract offline.',
         '> 3. Abort — drop this UI request',
         '',
         '**Recommendation: 2 — Supply the contract** — it is the only option ' +

package/src/config/agent-settings.template.yml

@@ -815,24 +815,21 @@ subagents:
 
 # --- Git worktrees ---
 #
-# Controls how the `using-git-worktrees` skill and `subagent-orchestration`
-# mode 6 (`do-in-worktrees`) behave. Mechanical layer on top of the
-# existing `scope-control` permission gate — narrows, never widens.
-worktrees:
-  # off | on | ask  (default: ask)
-  #
-  # ask = status quo. Skill asks before creating any worktree; mode 6 is
-  #       selectable when the chain shape warrants it. Matches the
-  #       behaviour required by `scope-control` and `autonomous-execution`.
-  # off = no autonomous worktree creation. Skill refuses; mode 6 falls
-  #       back to mode 3 (do-in-steps). Explicit user request in the
-  #       chat ("do this in a worktree", "use mode 6") overrides for
-  #       that single task — the setting suppresses *unprompted* usage,
-  #       not the tool itself.
-  # on  = standing permission. Skill skips the per-creation permission
-  #       ask; mode 6 may be picked without prompting. Iron-Law gates
-  #       (ignore-check, clean baseline) still apply.
-  mode: ask
+# There is no setting. Worktree creation is INSTRUCTION-ONLY (ADR-229):
+# `using-git-worktrees` and `subagent-orchestration` mode 6 (`do-in-worktrees`)
+# create a worktree ONLY when the user asks for one in the chat ("do this in a
+# worktree", "use mode 6"). Unprompted, mode 6 is not selectable and the chain
+# falls back to mode 3 (`do-in-steps`).
+#
+# `worktrees.mode` was DELETED. It offered `ask`/`on`/`off` over a decision that
+# was never the agent's to make: `ask` spent a round trip on every spawn, `on`
+# let the agent start parallel work on its own, and `off` was the behaviour
+# everyone actually wanted — so the setting's only real value was hardcoded and
+# the other two values removed. A leftover key from an older install is ignored
+# with one deprecation line (see `REMOVED_KEYS` in `_lib/agent_settings.ts`).
+#
+# The Iron-Law gates on creation (ignore-safety check, clean baseline) are
+# unchanged and still run on every explicitly-requested worktree.
 
 # --- AI Council (external second-opinion network) ---
 #

package/src/config/gate-coverage.yml

@@ -305,8 +305,8 @@ gates:
 
   - id: check_ci_local_parity
     argv: ["--quiet"]
-    min_scanned: 380
-    corpus: "CI + local gate invocations parsed from .github/workflows + taskfiles (443 at baseline)"
+    min_scanned: 340
+    corpus: "CI + local gate invocations parsed from .github/workflows + taskfiles (360 measured 2026-08-13: 109 CI + 251 local)"
     status: enforced
     note: >
       Registered 2026-08-02. It already emitted the contract line on every path,
@@ -317,6 +317,37 @@ gates:
       taskfile set, so the only plantable violation is a new file under
       .github/workflows — a surface the canary must not write to. Reported
       UNPROVEN by --canary, never green.
+      FLOOR RE-ANCHORED 380 → 340 on 2026-08-13, and the direction deserves an
+      argument rather than a diff.
+      The claim is NOT that 443 minus phantoms equals 360 — that arithmetic does
+      not close, and pretending otherwise would be the false-precision this
+      manifest exists to prevent. 443 was measured on 2026-08-02 against a
+      different tree: both a CI-side set inflated by 167 phantoms AND a smaller
+      local set than today's. The two totals are not comparable term by term.
+      What IS comparable is the repair's own before/after on ONE tree, which is
+      the measurement that matters here: CI-side 273 → 106, because gate names
+      were being read out of workflow COMMENTS by an extraction bug this gate's
+      own repair removed. So the fall is entries that never existed ceasing to be
+      counted, not reach being lost — the discriminator false-green.md § 5 asks
+      for ("a legitimate ratchet lowers severity while keeping reach"). Reach over
+      the real corpus is one unit HIGHER than before this change: the two gates
+      wired into consistency.yml were previously reachable from neither side.
+      Why 340 and not 360, the measured value: gate-authoring.md § registration
+      requires a floor BELOW the live count, because a floor pinned at today's
+      number reds on the very change that legitimately retires one unit. 340
+      leaves ~20 units (~5.5%) of headroom.
+      What this floor can and cannot catch, corrected after the R2 review caught
+      the first version arguing from a break that cannot fire it. The extraction
+      bug INFLATED the count — phantom gate names entering the CI set — so a
+      re-break raises the population to roughly 527 and a min_scanned floor never
+      triggers on a rise. The floor guards the opposite direction: an extractor
+      that stops finding taskfiles or workflows at all, a parse error zeroing one
+      side, a scan root that moves. Those are collapses of 100+ units and 340
+      catches every one of them. The realistic PARTIAL break — one taskfile
+      failing to parse, say ~14 units — passes 340 and would have failed 380,
+      which is the honest cost of the headroom and is accepted here rather than
+      hidden: a floor tight enough to catch that is also tight enough to red on
+      the next legitimate retirement.
 
   - id: check_site_links
     argv: []

package/src/config/gate-violation-baselines.json

@@ -2,9 +2,9 @@
   "$comment": "Violation ratchet for gates whose dead scan root was repaired. A repair REVEALS pre-existing debt; it does not create it. Each entry records the count revealed at repair time — the gate fails only when its count RISES. Lowering a count is a normal commit; raising one is a defect. Entries expire: a baseline that has not dropped within 56 days of `landed` (or of `reaffirmed.date`) fails its gate, because a number that never moves is suppression with extra steps. Mechanism + rationale: src/scripts/_lib/gate_baseline.ts. Decision: AI council 2026-08-02, roadmap road-to-gates-that-can-fail blocker `dead-gate-finding-triage`.",
   "gates": {
     "ci-parity:local-only": {
-      "count": 167,
+      "count": 166,
       "landed": "2026-08-13",
-      "note": "Gates that `task ci` runs and no workflow does — the direction this manifest's own header calls the one that let real defects merge (16 stale index rows reached the trunk behind a local-only check-index). Revealed, not created, by repairing the checker's extraction: check_ci_local_parity built its CI-side set by regexing RAW workflow text for `task <name>` and expanding each closure, comments included. Several workflow comments contain the literal string `task ci` while stating that no workflow invokes it, so `ci` was read as an invocation and its full 247-gate closure entered the 'runs in CI' set. The count was therefore 0 BY CONSTRUCTION, and the prose documenting the gap was what suppressed it. Measured at the repair: CI-side 273 → 106, undeclared_local_only 0 → 167 of 247 local gates (68%). Baselined rather than hard-failed because 167 findings nobody can clear in the change that reveals them is the gate-that-lands-as-N-instant-blockers failure this repository has refused before; shrink-only keeps the property that matters, namely that a NEW gate registered in `task ci` with no workflow reds immediately. Lowering happens by wiring gates into workflows or declaring them under `local_only:` with a reason. Note the punchline, because it bounds the risk of this entry: check_ci_local_parity ITSELF runs in no workflow, so it is its own finding and this ratchet has no remote reach either — clearing the backlog is what gives it teeth.",
+      "note": "Gates that `task ci` runs and no workflow does — the direction this manifest's own header calls the one that let real defects merge (16 stale index rows reached the trunk behind a local-only check-index). Revealed, not created, by repairing the checker's extraction: check_ci_local_parity built its CI-side set by regexing RAW workflow text for `task <name>` and expanding each closure, comments included. Several workflow comments contain the literal string `task ci` while stating that no workflow invokes it, so `ci` was read as an invocation and its full 247-gate closure entered the 'runs in CI' set. The count was therefore 0 BY CONSTRUCTION, and the prose documenting the gap was what suppressed it. Measured at the repair: CI-side 273 → 106, undeclared_local_only 0 → 167 of 247 local gates (68%). Baselined rather than hard-failed because 167 findings nobody can clear in the change that reveals them is the gate-that-lands-as-N-instant-blockers failure this repository has refused before; shrink-only keeps the property that matters, namely that a NEW gate registered in `task ci` with no workflow reds immediately. Lowering happens by wiring gates into workflows or declaring them under `local_only:` with a reason. Note the punchline, because it bounds the risk of this entry: check_ci_local_parity ITSELF runs in no workflow, so it is its own finding and this ratchet has no remote reach either — clearing the backlog is what gives it teeth. DRAINED BY ONE, 2026-08-13: check_ci_local_parity itself was wired into consistency.yml, so it left the set it exists to report. That is the whole shape of a legitimate drain here — the gate stops being local-only because a workflow now runs it, not because the declaration list grew. The floor in gate-coverage.yml moved in the same change and for the same reason: wiring two gates raised the parsed population 357 -> 360 (109 CI + 251 local). The intermediate 359 was the reading after the CI-side wiring alone and before check_gate_coverage joined the local `ci` chain; it was committed here by mistake and is corrected rather than left as a second number for the same measurement.",
       "falsifier": "./scripts-run src/scripts/check_ci_local_parity"
     },
     "check_no_new_legacy_path:hardcoded-scan-roots": {

package/src/config/pack-size-budget.json

@@ -20,9 +20,10 @@
         "rationale": "Measured 2026-07-31: the largest non-excepted skill is corpus-grounding at 2.33%, so a 5% cap is green with better than 2x headroom and red for any skill that doubles. It is a falsifiable gate, not a ritual one.",
         "exceptions": {
             "design-intelligence": {
-                "max_pct": 23.0,
+                "max_pct": 23.5,
                 "measured_pct": 22.63,
-                "reason": "771 KB of BM25 corpus (27 CSVs + 16 design-language prose specs + manifest.json) consumed at runtime by corpus-grounding's retriever, and referenced by 6 further skills. Moving it behind a lazy fetch would add a network dependency to a skill that works offline today — the same trade-off ADR-061 §8 already REJECTED for a 745 KB font index. The exception is visible debt, not an endorsement: raising max_pct requires a reason in the same commit."
+                "reason": "771 KB of BM25 corpus (27 CSVs + 16 design-language prose specs + manifest.json) consumed at runtime by corpus-grounding's retriever, and referenced by 6 further skills. Moving it behind a lazy fetch would add a network dependency to a skill that works offline today — the same trade-off ADR-061 §8 already REJECTED for a 745 KB font index. The exception is visible debt, not an endorsement: raising max_pct requires a reason in the same commit.",
+                "baseline_note_2026_08_13": "23.0 → 23.5 on 2026-08-13, and the reason belongs in this file per the sentence above. WHAT WAS ADOPTED: data/motion.csv, 10.5 KB, 16 rows. WHY IT IS NOT DISCRETIONARY: the roadmap's three design dials were all in its original scope, and two of the three (variance, density) were already portable — variance's keywords resolve against the local styles.csv (2/3/3 hits) and density is three pure range maps. The motion dial is not: upstream filters its corpus rows by `Intensity Tier == <dial tier>`, and that column exists only in motion.csv, so shipping the dial without the file means shipping a flag that silently does nothing. Two of three dials plus an inert third is a worse surface than three working ones. WHAT WAS DECLINED IN THE SAME PASS, so this is not a ratchet slipping: google-fonts.csv (743 KB — ADR-061 §8 rejects it by name and by size; the 2026-06-16 amendment authorises a slim top-N slice from a different mirror, not this file), typography.csv (our curated font-pairings-reference.csv is the ADR's working substitution), six desktop-UI stacks outside frontend-design's scope, and eleven content-drifted files nobody has reviewed. The base pin in ATTRIBUTION.md is deliberately NOT bumped for the same reason. HONEST LIMIT ON THE NUMBER: 22.63 is the committed measurement, not a fresh one — check_pack_size cannot be re-measured from a built worktree (it reads 9.096 against the 7.8 packed cap before any change, the trap the packed_size_mb note above documents), so the post-adoption share is arithmetic (~22.87 %) and the new cap carries ~0.6 pp over it rather than clearing by a hair. DECIDED BY: AI council, 2026-08-13, on a maintainer delegation — and honestly, by ONE member over two rounds, not by convergence: the second seat returned exit_1 (the codex CLI refuses a git worktree as an untrusted directory). Recorded as a single-member review in agents/evidence/analysis/design-system-blockers-council.md."
             }
         }
     }

package/src/scripts/_lib/agent_settings.ts

@@ -922,6 +922,13 @@ export function load_agent_settings(
  * whether the repair is to build its missing reader or to delete a promise a
  * Hard Floor can never honour. See `settings-classes.md` § The six unread keys.
  *
+ * `worktrees.mode` (2026-08-13, ADR-229) is a third doctrine again: not
+ * always-on, not unread. It WAS read, and the reader honoured all three values —
+ * the deletion says the decision was never the agent's to make. `ask` bought a
+ * round trip per spawn, `on` let the agent start parallel work unprompted, and
+ * `off` described the wanted behaviour, so `off` became the hardcoded rule and
+ * the switch went. What decides instead is the user's own sentence in the chat.
+ *
  * Every reason string must name what decides INSTEAD, never just "removed".
  * Exported so `lint_settings_classes` can check the deletion side of the
  * surface: a reason that names no replacement, or an entry whose key is live in
@@ -942,6 +949,7 @@ export const REMOVED_KEYS: ReadonlyMap<string, string> = new Map([
     ['chat_history.on_overflow', 'the overflow mode comes from the rotate command --mode argv'],
     ['quality.wait_for_remote_ci', 'whether to poll follows from the push plus a detectable remote pipeline'],
     ['legal_review_prep.consented_at', 'the provenance sidecar settings:set writes and consentVerdict reads'],
+    ['worktrees.mode', 'the user asking for a worktree in the chat; creation is instruction-only and hardcoded'],
 ]);
 
 /** Keys already warned about in THIS process — the "once per run" dedupe. */